This is really helpful Jon - thanks. Going to get those APEX images off our ORDS server.

Hi - other outbound calls should have no issues; the problem for Social Sign On and SSO is that ORDS passes a callback URL to SSO which doesn't match the reverse proxy - bit of a specialized exception. There's no mechanism to change this that I'm aware of. Otherwise, all should be well.

You can enable MFA in OCI with a few quick steps, including the Mobile Authenticator app. See: https://jmjcloudblog.hashnode.dev/first-steps-to-secure-your-oci-account

Hey Jon - you don't have to use customer-managed ORDS in this use-case, however, one of the things I'm finding is that the approach above breaks Social Sign-on. So if that's a requirement, you're into customer-managed ORDS territory. See the "Epilogue" above.